Personal Data Policy

Last updated: 7 March 2025

Preamble

The General Data Protection Regulation (GDPR) came into force on 25 May 2018 and supplements the legislation on the protection of personal data. For your information, personal data means any information relating to a natural person who is identified or can be identified, directly or indirectly, by reference to an identification number or to one or more factors specific to them (surname, first name, address, email, telephone…).

Processing of personal data means any operation performed on this type of data (collection, storage, transmission, deletion…), whether on paper or electronically. The data controller is the person who determines the purposes of each processing operation and the means used to achieve them.

The company reserves the right to amend this Privacy Policy at any time. Any change will take effect immediately.

We therefore invite you to consult our Policy regularly to stay informed of the latest version in force online.

Purpose of data processing

The purpose of the processing is the management of clinical trial imaging.

As a general rule, Pixilib does not process any of your data for purposes incompatible with those for which it was collected, unless you have given your prior consent.

Data processed

The data collected may be grouped into the following categories:

  • Identity
  • Contact details (surname, first name, date of birth, email address, city, telephone)
  • Position, title and place of work
  • University degrees

The recipients of the data are:

  • Pixilib
  • Email delivery service: SendGrid
  • Retention period: data is kept for as long as necessary to achieve the purposes of the processing and for no longer than a maximum of 5 years.

Pixilib does not transfer any data outside the European Union. However, Pixilib uses the service provider SendGrid to manage the sending of its emails. SendGrid will have access to the data you submit through Pixilib’s contact form.

This data will then be stored in data centres located outside the European Union.

To this end, SendGrid provides specific and appropriate security measures such as:

  • Data encryption
  • Encryption of data transmissions
  • Destruction of documents containing identifying data about users
  • Various physical security measures at their data centres

Pixilib collects your personal data for the purposes described in the “Purpose of data processing” section of this Policy.

In all cases, Pixilib only collects your data where its collection and processing are based on a legal ground. Subject to having obtained your prior consent, Pixilib may process your data in order to send you commercial offers about its products and services.

Security

Pixilib implements all technical, physical and organisational measures to ensure the security and confidentiality of your data during the collection, processing and transfer of your data.

Pixilib’s infrastructure is protected against malicious software; the security of your own device is your responsibility.

Should we use service providers to process part of your data, we undertake to verify that they provide sufficient guarantees to ensure the protection of the personal data entrusted to them and to have them sign confidentiality clauses compliant with Article 28 of the GDPR.

In the event of a personal data breach, we undertake to comply with the following obligations:

  • No risk: internal documentation in the “breach register”.
  • Proven risk: internal documentation and notification to the CNIL (French data protection authority) within a maximum of 72 hours.
  • High risk: internal documentation, notification to the CNIL within a maximum of 72 hours and information of the persons concerned as soon as possible.

The “breach register” contains the following information:

  • The nature of the breach
  • The categories and approximate number of persons concerned
  • The categories and approximate number of files concerned
  • The likely consequences of the breach
  • The measures taken to remedy the breach and, where applicable, to limit its negative consequences
  • Where applicable, the justification for not notifying the CNIL or not informing the persons concerned

However, we are not required to inform you of a breach in the following cases:

  • Your data is protected by measures that render it unintelligible to any unauthorised person
  • Measures have been taken so that the risk is no longer likely to materialise
  • Such communication would require disproportionate effort, in particular where we have no means of contacting you

Accountability

In order to meet our responsibilities, our company:

  • Adopts internal procedures to ensure compliance with the regulation (IT charter, personal data protection charter)
  • Keeps documentary records of all processing carried out under its responsibility or that of its processor (record of processing activities, confidentiality agreements, security policy, procedures for handling requests for access, rectification, objection…)
  • Carries out data protection impact assessments (DPIA) for processing operations presenting particular risks to rights and freedoms

Your rights regarding your data

You may access and obtain a copy of the data concerning you, object to the processing of this data, and have it rectified or erased. You also have the right to restriction of the processing of your data.

The data protection officer is your contact for any request to exercise your rights.

Any request must state, in its subject line, the reason for the request (exercise of the right of access, objection…). The request must also be accompanied by a copy of both sides of a valid identity document bearing the requester’s signature, and must specify the address to which the reply should be sent.

Pixilib will reply within a maximum of one (1) month from the date of receipt of your request. This period may, however, be extended by two (2) months due to the complexity and number of requests.

Contact the data protection officer by email: p.leguellec@yeched-mat.com

Contact the data protection officer by post:

Pierre Le Guellec
Yec’hed Mat Conseil
256 rue de Bègles
33800 Bordeaux